I am working on some obfuscated code. To my understanding, here is how the obfuscation works:
Take the subroutine you want to obfuscate, like;
LDR R2, [R0,#8]
MOV R0, #0
CMP R2, R1
MOVEQ R0, #1
BX LR
Take a few hundred to thousand of these and chain them:
LDR PC, =0xabcd
Occasionally in the chain, add the next instruction of the function before the next LDR instruction.
LDR R2, [R0,#8]
LDR PC, =0x1234
... another 300 jumps...
MOV R0, #0
LDR PC, =0x5678
...etc
So when stepping through this program in a debugger, you have to follow a few hundred of these LDR, PC =0xABCD "chained" together before you reach the next instruction of actual code.
What is this called, and how is it generated? Is there an easy way to skip all the jumping around when debugging in IDA (ie. step to the next non-LDR PC, = instruction)
